feat: add enterprise network configuration support by austenstone · Pull Request #3274 · integrations/terraform-provider-github

austenstone · 2026-03-15T15:58:19Z

Overview

This PR adds enterprise-scoped hosted compute network configuration support for GitHub-hosted private networking.

It introduces a new github_enterprise_network_configuration resource and adds network_configuration_id support to github_enterprise_actions_runner_group so enterprise runner groups can be associated with hosted compute network configurations.

This work is closely related to the organization-scoped implementation in #2895, and follows the same review-driven cleanup patterns to stay aligned with current project conventions.

What this PR adds

New resource: github_enterprise_network_configuration
Full CRUD support for enterprise network configurations
Import support for enterprise network configurations
network_configuration_id support in github_enterprise_actions_runner_group
Acceptance coverage for enterprise network configuration create/update/import flows
Acceptance coverage for enterprise runner group private networking association flows
Documentation updates for enterprise network configuration and enterprise runner groups

Notes

GitHub-hosted private networking is attached through the runner group via network_configuration_id.
The runner group create endpoint does not accept network_configuration_id, so the provider applies the networking association with a follow-up PATCH after creation.
This branch was cleaned up to mirror the review feedback already applied on the organization-scoped work in #2895: direct state setting in Create, safer GitHub error response checks, and ConfigStateChecks for the newer acceptance assertions.
This PR also includes a small correctness fix in the touched runner group read path: getOrganizationRunnerGroup now only swallows 304 Not Modified instead of treating arbitrary ErrorResponse values as cache hits.
Runner group Create now sets Terraform state directly from the create response and only falls back to a follow-up Read when the private networking association requires the extra PATCH.

Validation

make testacc
make test

github-actions · 2026-03-15T15:58:28Z

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

deiga · 2026-03-15T16:14:54Z

Your validation commands would not actually run the tests. You should use make testacc and make test

tag-assistant

Re-review ✅

All previous feedback addressed, plus some nice extras:

Addressed:

✅ Shared runnerGroupNetworking struct + helpers in resource_github_actions_runner_group_networking.go — clean dedup
✅ getRunnerGroupNetworking now takes a path string, works for both org and enterprise scopes
✅ Trailing newline fixed on enterprise docs
✅ StatusNotModified handling added to getRunnerGroupNetworking — consistent with the rest of the codebase

Bonus improvements (not requested):

🧪 173-line unit test file for all three shared helpers (get, update, setState) — including 304 handling and null payload for removal. Solid.
🔧 normalizeEtag() in util.go to handle weak vs strong ETag drift between create and read paths — nice catch, prevents state churn.
🧪 Unit tests for normalizeEtag covering empty, strong, weak, and whitespace cases.

LGTM. Ship it 🚢

deiga

Partial review

github/resource_github_actions_runner_group.go

deiga · 2026-03-16T20:16:35Z

github/resource_github_actions_runner_group_helpers.go

+		"network_configuration_id": networkConfigurationID,
+	}
+
+	req, err := client.NewRequest("PATCH", path, payload)


issue: use only go-github provided functions

I checked go-github v83 locally before changing this — there isn’t a first-class runner-group networking method for this endpoint yet, so this still has to stay as a thin NewRequest/Do shim for now.

With google/go-github#4099, UpdateOrganizationRunnerGroup now accepts NetworkConfigurationID in the request struct, and GetOrganizationRunnerGroup returns it on the response. So yes — once that merges, this raw call can be replaced with the native go-github UpdateOrganizationRunnerGroup/UpdateEnterpriseRunnerGroup functions and the separate getRunnerGroupNetworking GET becomes unnecessary too.

Org side is now fully native — no more raw calls for org runner groups. The helpers file is still needed for enterprise since go-github hasn't released a version with NetworkConfigurationID on EnterpriseRunnerGroup / UpdateEnterpriseRunnerGroupRequest yet (google/go-github#4099 merged but isn't in a release). Once that ships, a follow-up PR will switch enterprise to native functions and remove the helpers entirely.

github/resource_github_enterprise_actions_runner_group.go

github/resource_github_enterprise_actions_runner_group_test.go

deiga

Partial review

github/resource_github_actions_runner_group.go

deiga · 2026-03-16T21:09:06Z

github/resource_github_actions_runner_group.go

+		networkConfigurationIDValue := networkConfigurationID.(string)
+		// The create endpoint does not accept network_configuration_id, so private networking
+		// must be attached with a follow-up PATCH after the runner group has been created.
+		if _, err = updateRunnerGroupNetworking(client, ctx, fmt.Sprintf("orgs/%s/actions/runner-groups/%d", orgName, runnerGroup.GetID()), &networkConfigurationIDValue); err != nil {


Isn't this UpdateOrganizationRunnerGroup what you're looking for?

Yes — once google/go-github#4099 merges, UpdateOrganizationRunnerGroup will carry NetworkConfigurationID natively and this raw call goes away.

That doesn't make sense. The function already exists

You're right — my earlier reply was wrong. I confused the org and enterprise types. UpdateOrganizationRunnerGroup already had NetworkConfigurationID in go-github; the missing field was only on the enterprise side.

Fixed — org Create and Update now pass NetworkConfigurationID natively via CreateRunnerGroupRequest / UpdateRunnerGroupRequest. The separate PATCH is gone. Read also pulls NetworkConfigurationID directly from the RunnerGroup response instead of the separate networking GET.

Enterprise still uses raw calls since go-github doesn't have NetworkConfigurationID on the enterprise types yet (added in google/go-github#4099, merged but not released). Will switch enterprise to native functions once that ships in a go-github release.

github/resource_github_actions_runner_group.go

deiga · 2026-03-16T21:16:27Z

github/resource_github_actions_runner_group_helpers.go

+}
+
+func getRunnerGroupNetworking(client *github.Client, ctx context.Context, path string) (*runnerGroupNetworking, *github.Response, error) {
+	req, err := client.NewRequest("GET", path, nil)


If the functions don't exist in go-github, then you should open a PR in there to add them. We don't accept direct API endpoint interactions

github/resource_github_actions_runner_group_helpers_test.go

…unner group types Add NetworkConfigurationID and HostedRunnersURL fields to EnterpriseRunnerGroup, and NetworkConfigurationID to CreateEnterpriseRunnerGroupRequest and UpdateEnterpriseRunnerGroupRequest to match the GitHub API response schema. These fields already exist on the organization-scoped RunnerGroup type but were missing from the enterprise equivalents. The GitHub API returns both fields on enterprise runner group endpoints (List, Get, Create, Update). Fixes: integrations/terraform-provider-github#3274

austenstone · 2026-03-16T21:56:16Z

All review feedback addressed except the raw NewRequest/Do calls — those are blocked on google/go-github#4099 which adds NetworkConfigurationID to the runner group structs. Once that merges and we bump the dependency, the helpers file goes away and networking flows through the native UpdateOrganizationRunnerGroup/UpdateEnterpriseRunnerGroup functions.

…etwork configurations

… groups

…groups

…tation for network settings

…date related documentation

…d unit tests for normalization

…proved readability

…tate management

…n documentation

…ement

… improve error handling

The response is always non-nil on the success path — if the API call errors we return early, and even the 304 Not Modified path returns a valid response object. The fallback to the stored ETag was unreachable.

…ming confusion

- Use native NetworkConfigurationID on CreateRunnerGroupRequest and UpdateRunnerGroupRequest for org runner groups (already in go-github v83) - Read NetworkConfigurationID from RunnerGroup response instead of separate getRunnerGroupNetworking call for org runner groups - Exit early on 304 Not Modified in both org and enterprise Read - Add unit tests for 304 handling and NetworkConfigurationID deserialization - Enterprise runner groups still use raw API calls (go-github v83 lacks enterprise NetworkConfigurationID — will be addressed in v84 upgrade PR)

deiga

Please mark this as Draft until the go-github version is released and an upgrade PR is merged. We will not accept PRs with direct API interactions

github-actions bot added the Type: Feature New feature or request label Mar 15, 2026

This comment was marked as resolved.

Sign in to view

austenstone mentioned this pull request Mar 16, 2026

feat: Add github_organization_network_configuration resource #2895

Closed

austenstone requested a review from tag-assistant March 16, 2026 16:42

tag-assistant approved these changes Mar 16, 2026

View reviewed changes

deiga suggested changes Mar 16, 2026

View reviewed changes

austenstone mentioned this pull request Mar 16, 2026

feat: Add NetworkConfigurationID and HostedRunnersURL to enterprise runner group types google/go-github#4099

Merged

austenstone force-pushed the feature/github-enterprise-network-configurations branch 2 times, most recently from 508630f to 022c485 Compare March 20, 2026 14:18

austenstone added 15 commits March 20, 2026 10:29

feat: add organization network configuration resource

f3072ca

refactor: clean up network configuration resource

7577bac

test: align network configuration resource with repo patterns

4eed95f

docs: polish organization network configuration resource

122ce72

refactor: use RFC3339 constant for network configuration timestamps

b3c466b

refactor: address network configuration review comments

84d351a

refactor: align network configuration with project patterns

e097ca3

refactor: enhance error handling and documentation for organization n…

eb4cd67

…etwork configurations

feat: add support for network configurations in GitHub Actions runner…

a784c75

… groups

feat: add network configuration validation for GitHub Actions runner …

2bb209d

…groups

feat: update advanced hosted runner configuration and enhance documen…

94f04b6

…tation for network settings

feat: add support for GitHub enterprise network configurations and up…

a01cd06

…date related documentation

refactor: align runner group networking with review feedback

0a14c30

refactor: align enterprise runner group networking with review feedback

6347009

feat: normalize ETag handling in runner group state management and ad…

be069e1

…d unit tests for normalization

austenstone added 9 commits March 20, 2026 10:31

fix: use context directly in runner group networking functions for im…

0b680d0

…proved readability

refactor: consolidate runner group networking functions and improve s…

bc87f1f

…tate management

fix: ensure newline at end of file in enterprise network configuratio…

dbbcd71

…n documentation

feat: add tests for runner group networking functions and state manag…

be49b46

…ement

feat: update GitHub Actions runner group functions to use context and…

d821a72

… improve error handling

fix: remove unnecessary resp nil guards in runner group Read/Update

a523a06

The response is always non-nil on the success path — if the API call errors we return early, and even the 304 Not Modified path returns a valid response object. The fallback to the stored ETag was unreachable.

refactor: rename runner group networking helpers to avoid resource na…

d0b72ae

…ming confusion

refactor: remove unnecessary ctx and blank lines per review

e9b1e28

austenstone force-pushed the feature/github-enterprise-network-configurations branch from 022c485 to b46b622 Compare March 20, 2026 14:33

austenstone requested review from deiga and tag-assistant March 20, 2026 14:49

deiga added Upstream Status: Blocked Some technical or requirement is blocking the issue labels Mar 20, 2026

deiga suggested changes Mar 20, 2026

View reviewed changes

Conversation

austenstone commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

What this PR adds

Notes

Validation

Uh oh!

github-actions bot commented Mar 15, 2026

Uh oh!

deiga commented Mar 15, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

tag-assistant left a comment

Choose a reason for hiding this comment

Re-review ✅

Uh oh!

deiga left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

deiga left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

austenstone commented Mar 16, 2026

Uh oh!

deiga left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

austenstone commented Mar 15, 2026 •

edited

Loading